Leak of email addresses from VirginMedia server?

[JFA]

I have just received a malware-link email whose To: and From: addresses in the source are:

john.evans16
john.evans490
john.evans510
john.eyre
john.f.ash
john.f.kennedy

all at ntlworld.com

This looks to me like a segment of the complete alphabetical list of ntlworld.com mail addresses, which could only have come from a server, and therefore implies a serious data leak. None of these addresses (except mine) are known to me, and it is extremely unlikely that they would all be in anyone's address book. There are currently no indications that my account has been compromised.

(a) Has anyone else seen something like this?
(b) How do I report this to Virgin Media?
(c) Should I attempt to publicise it more widely, and if so, how?

 

[Mark.J]

Spam robots will often collect and send out to millions of addresses using popular, known and or random combinations to find working recipients. But if such details had been pulled from a secure database then the fraudsters would usually make use of that, such as by identifying you via a full name in the message content in order to make it look more legitimate.

I think you can report any concerns here:

http://netreport.virginmedia.com/netreport/

 

[JFA]

Spam robots will often collect and send out to millions of addresses using popular, known and or random combinations to find working recipients. But if such details had been pulled from a secure database then the fraudsters would usually make use of that, such as by identifying you via a full name in the message content in order to make it look more legitimate.

I think you can report any concerns here:

http://netreport.virginmedia.com/netreport/

Thanks, Mark, for the reporting information.

The plausibility of the addresses coming from a randomly found/probed list depends entirely on how many real addresses are missing from the alphabetical list, which only VirginMedia can establish. It would also be useful to try to collect other similar examples to increase the statistical significance, and the obvious place to suggest that is VM's forum, to which I have already posted.

 

[Mark.J]

Let us know if you discover anything further.

 

[misterdog]

You are not alone, since VM migrated from Google servers last year there are many hundreds of their mail users with compromised accounts .

See the Facebook group here
https://www.facebook.com/groups/VMspoofingemails/